From 2a3b7348be7d2a4b76b364686fb2dc1e0b9f04d4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 19 Dec 2018 01:01:53 +0000 Subject: [PATCH] Add in minor changes and remove the duplicate plugins for mac. --- volatility/framework/plugins/mac/psaux.py | 14 +-- volatility/framework/plugins/mac/pslist.py | 22 +++-- .../symbols/mac/extensions/__init__.py | 2 +- volatility/plugins/mac/psaux.py | 92 ------------------- volatility/plugins/mac/pslist.py | 79 ---------------- 5 files changed, 23 insertions(+), 186 deletions(-) delete mode 100644 volatility/plugins/mac/psaux.py delete mode 100644 volatility/plugins/mac/pslist.py diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility/framework/plugins/mac/psaux.py index 16705d237..bcc09d8a0 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility/framework/plugins/mac/psaux.py @@ -29,10 +29,10 @@ class Psaux(plugins.PluginInterface): argsstart = task.user_stack - task.p_argslen - if (not proc_layer.is_valid(argsstart) or not task.p_argslen or not task.p_argc): + if not proc_layer.is_valid(argsstart) or task.p_argslen == 0 or task.p_argc == 0: continue - # Add one because the first two are usually duplicates + # Add one because the first two are usually duplicates argc = task.p_argc + 1 # smear protection @@ -50,13 +50,13 @@ class Psaux(plugins.PluginInterface): break idx = arg.find(b'\x00') - if idx > -1: + if idx != -1: arg = arg[:idx] argsstart += len(str(arg)) + 1 # deal with the stupid alignment (leading nulls) and arg duplication - if not args: + if len(args) == 0: while argsstart < task.user_stack: try: check = proc_layer.read(argsstart, 1) @@ -74,17 +74,17 @@ class Psaux(plugins.PluginInterface): elif arg != args[0]: args.append(arg) - argc -= 1 + argc = argc - 1 args_str = " ".join([s.decode("utf-8") for s in args]) yield (0, (task.p_pid, task_name, task.p_argc, args_str)) def run(self) -> renderers.TreeGrid: - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filt = pslist.PsList.create_filter([self.config.get('pid', None)]) plugin = pslist.PsList.list_tasks return renderers.TreeGrid( [("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)], - self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter))) + self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt))) diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index 7427e379c..cf70e447e 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -1,5 +1,5 @@ import logging -from typing import Callable, Generator, List +from typing import Callable, Iterable, List import volatility.framework.interfaces.plugins as interfaces_plugins from volatility.framework import renderers, interfaces @@ -23,13 +23,21 @@ class PsList(interfaces_plugins.PluginInterface): @classmethod def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]: - filter = lambda _: False + + def nullfilter(): + return False + + filt = nullfilter # FIXME: mypy #4973 or #2608 pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] if filter_list: - filter = lambda x: x not in filter_list - return filter + + def list_filter(x): + return x not in filter_list + + filt = list_filter + return filt def _generator(self): for task in self.list_tasks( @@ -47,8 +55,8 @@ class PsList(interfaces_plugins.PluginInterface): context: interfaces.context.ContextInterface, layer_name: str, mac_symbols: str, - filter: Callable[[int], bool] = lambda _: False) \ - -> Generator[interfaces.objects.ObjectInterface, None, None]: + filter: Callable[[int], bool] = lambda _: False) -> \ + Iterable[interfaces.objects.ObjectInterface]: """Lists all the tasks in the primary layer""" aslr_shift = mac.MacUtilities.find_aslr(context, mac_symbols, layer_name) @@ -56,7 +64,7 @@ class PsList(interfaces_plugins.PluginInterface): proc = darwin.object(symbol_name = "allproc").lh_first seen = {} - while proc != None and proc.vol.offset != 0: + while proc is not None and proc.vol.offset != 0: if proc.vol.offset in seen: vollog.log(logging.INFO, "Recursive process list detected (a result of non-atomic acquisition).") break diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index 767b896e1..764eb80d6 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -224,7 +224,7 @@ class vm_map_entry(generic.GenericIntelProcess): vnode_object = self.get_object().get_map_object() found_end = False - + while not found_end: try: tmp_vnode_object = vnode_object.shadow.dereference() diff --git a/volatility/plugins/mac/psaux.py b/volatility/plugins/mac/psaux.py deleted file mode 100644 index aedc5e236..000000000 --- a/volatility/plugins/mac/psaux.py +++ /dev/null @@ -1,92 +0,0 @@ -"""A module containing a collection of plugins that produce data -typically found in Linux's /proc file system. -""" - -from volatility.framework import exceptions, renderers -from volatility.framework.interfaces import plugins -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.plugins.mac import pslist - - -class Psaux(plugins.PluginInterface): - """Recovers program command line arguments""" - - @classmethod - def get_requirements(cls): - return [ - requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac Kernel") - ] - - def _generator(self, tasks): - for task in tasks: - task_name = utility.array_to_string(task.p_comm) - - proc_layer_name = task.add_process_layer() - if proc_layer_name is None: - print("no proc layer") - continue - - proc_layer = self.context.memory[proc_layer_name] - - argsstart = task.user_stack - task.p_argslen - - if not proc_layer.is_valid(argsstart) or task.p_argslen == 0 or task.p_argc == 0: - continue - - # Add one because the first two are usually duplicates - argc = task.p_argc + 1 - - # smear protection - if argc > 1024: - continue - - args = [] - - while argc > 0: - try: - arg = proc_layer.read(argsstart, 256) - except exceptions.PagedInvalidAddressException: - break - - idx = arg.find(b'\x00') - if idx != -1: - arg = arg[:idx] - - argsstart += len(str(arg)) + 1 - - # deal with the stupid alignment (leading nulls) and arg duplication - if len(args) == 0: - while argsstart < task.user_stack: - try: - check = proc_layer.read(argsstart, 1) - except exceptions.PagedInvalidAddressException: - break - - if check != b"\x00": - break - - argsstart = argsstart + 1 - - args.append(arg) - - # also check for initial duplicates since OS X is painful - elif arg != args[0]: - args.append(arg) - - argc = argc - 1 - - args_str = " ".join([s.decode("utf-8") for s in args]) - - yield (0, (task.p_pid, task_name, task.p_argc, args_str)) - - def run(self): - filt = pslist.PsList.create_filter([self.config.get('pid', None)]) - - plugin = pslist.PsList.list_tasks - - return renderers.TreeGrid( - [("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)], - self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt))) diff --git a/volatility/plugins/mac/pslist.py b/volatility/plugins/mac/pslist.py deleted file mode 100644 index cf70e447e..000000000 --- a/volatility/plugins/mac/pslist.py +++ /dev/null @@ -1,79 +0,0 @@ -import logging -from typing import Callable, Iterable, List - -import volatility.framework.interfaces.plugins as interfaces_plugins -from volatility.framework import renderers, interfaces -from volatility.framework.automagic import mac -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility - -vollog = logging.getLogger(__name__) - - -class PsList(interfaces_plugins.PluginInterface): - """Lists the processes present in a particular mac memory image""" - - @classmethod - def get_requirements(cls): - return [ - requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac Kernel") - ] - - @classmethod - def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]: - - def nullfilter(): - return False - - filt = nullfilter - # FIXME: mypy #4973 or #2608 - pid_list = pid_list or [] - filter_list = [x for x in pid_list if x is not None] - if filter_list: - - def list_filter(x): - return x not in filter_list - - filt = list_filter - return filt - - def _generator(self): - for task in self.list_tasks( - self.context, - self.config['primary'], - self.config['darwin'], - filter = self.create_filter([self.config.get('pid', None)])): - pid = task.p_pid - ppid = task.p_ppid - name = utility.array_to_string(task.p_comm) - yield (0, (pid, ppid, name)) - - @classmethod - def list_tasks(cls, - context: interfaces.context.ContextInterface, - layer_name: str, - mac_symbols: str, - filter: Callable[[int], bool] = lambda _: False) -> \ - Iterable[interfaces.objects.ObjectInterface]: - """Lists all the tasks in the primary layer""" - - aslr_shift = mac.MacUtilities.find_aslr(context, mac_symbols, layer_name) - darwin = context.module(mac_symbols, layer_name, aslr_shift) - proc = darwin.object(symbol_name = "allproc").lh_first - - seen = {} - while proc is not None and proc.vol.offset != 0: - if proc.vol.offset in seen: - vollog.log(logging.INFO, "Recursive process list detected (a result of non-atomic acquisition).") - break - else: - seen[proc.vol.offset] = 1 - - yield proc - - proc = proc.p_list.le_next.dereference() - - def run(self): - return renderers.TreeGrid([("PID", int), ("PPID", int), ("COMM", str)], self._generator())